1. Field of the Invention
This invention relates to validation of executable files.
2. Description of the Related Art
Among all computing and networking security issues, the most important cause of concern does not come from intrusions, but from the widespread proliferation of viruses. Viral infections represent the great majority of all security incidents and consume massive amounts of time and resources in their detection and in correcting problems associated with the execution of undetected viruses on a system.
In their most basic form, viruses and other unwanted programming instructions manifest themselves in unwanted code and/or programs inserted into files that executed on a computer system. The various manners in which such unwanted instructions are copied into computer systems are well known and are thus not discussed further herein.
To combat the problem of viruses and other unwanted code finding their way onto and executing on computer systems, virus scan programs have been developed to identify the existence of viruses on a system. In addition, executable programs have been developed which are digitally signed, whereby a kernel checks the digital signature each time the executable file is to be run, refusing to allow it to run if the signature is not valid.
Virus scan programs have been developed to identify the existence of viruses on a system. Each file on a computer system is scanned and a check sum or hash value (or simply “hash”) is created for each file. A hash, also called a message digest, is a number generated from a string of text. The hash is substantially smaller than the text itself, and is generated by a formula in such a way that is extremely unlikely that some other text will produce the same hash value. Hashes play a role in security systems where they are used to ensure that transmitted messages have not been tampered with. The sender generates a hash of the message, encrypts it, and sends it with the message itself. The recipient then decrypts both the message and the hash, produces another hash from the received message, and compares the two hashes. If they are the same, there is a high probability that the message was transmitted intact. The concept of hashing is well known and is not discussed further herein.
The file name and the hash value are compared to a virus signature file which contains information regarding all known viruses as of the date the virus scan program was last updated. If a match is found (i.e., if the file name, or elements of the file itself (it's hash matches a known virus hash), correspond to the name or elements of a known virus), the file containing the match is quarantined and rendered inoperable, repaired, or deleted. The virus signature files are updated periodically, e.g., weekly or more frequently if needed as new virus files are discovered. This requires users to run a complete virus scan on all files each time the virus signature files are updated.
Virus scan programs take a long time to perform their scanning and checking process. For each 10 Gigabytes of memory, it can take approximately 30 minutes to complete a scan and check operation. As the size of hard drives increase, and with the increase in size of software images due to multimedia content, such as MP3 and digital pictures, the problem of increased scan time is only getting worse. The scanning operation itself uses significant system resources and thus delays other operations that a user is attempting to perform. Further, with the proliferation of mobile laptop devices, it is often impossible to schedule virus scans during off hours, as can be done with desktop systems that are never turned off, since laptop systems are typically turned off when not in operation.
The digital signatures on the executables can be of two types: symmetric or asymmetric. A symmetric signature uses a secret key to key a message authentication code (MAC), taken across the entire content of the executable file. Symmetric signatures can be verified with relatively little overhead, but the key must remain secret, or the attacker can forge valid signatures. This makes symmetric signatures useful only in the local case. In addition, the key must be kept secret on the local machine, and this is very difficult to do.
An asymmetric signature uses a public key signature pair, such as with the RSA signature scheme. In this case the private key is used to sign, and the public key is used to verify the signature. The private key needs to remain secret, but need exist only on the signing system. All other systems can verify the signature knowing only the public key, which need not be secret. Thus executables signed with asymmetric signatures are muc more flexible, as the signed executable can be widely distributed, while the signing remains centralized. Unfortunately, public key signature verification have much higher overhead than symmetric ones.
Accordingly, it would be desirable to have a system and method for decreasing the time and overhead associated with verifying executable files.